Merge intel.com:/home/lenb/bk/26-latest-ref

into intel.com:/home/lenb/src/26-latest-dev

Documentation/DocBook/kernel-api.tmpl

@@ -133,6 +133,11 @@ KAO -->
      <sect1><title>Socket Filter</title>
 !Enet/core/filter.c
      </sect1>
+     <sect1><title>Generic Network Statistics</title>
+!Iinclude/linux/gen_stats.h
+!Enet/core/gen_stats.c
+!Enet/core/gen_estimator.c
+     </sect1>
   </chapter>
 
   <chapter id="netdev">

arch/i386/pci/mmconfig.c

@@ -102,6 +102,13 @@ static int __init pci_mmcfg_init(void)
 	if (!pci_mmcfg_base_addr)
 		goto out;
 
+	/* Kludge for now. Don't use mmconfig on AMD systems because
+	   those have some busses where mmconfig doesn't work,
+	   and we don't parse ACPI MCFG well enough to handle that. 
+	   Remove when proper handling is added. */
+	if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+		goto out; 
+
 	printk(KERN_INFO "PCI: Using MMCONFIG\n");
 	raw_pci_ops = &pci_mmcfg;
 	pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;

arch/x86_64/pci/mmconfig.c

@@ -78,6 +78,13 @@ static int __init pci_mmcfg_init(void)
 	if (!pci_mmcfg_base_addr)
 		return 0;
 
+	/* Kludge for now. Don't use mmconfig on AMD systems because
+	   those have some busses where mmconfig doesn't work,
+	   and we don't parse ACPI MCFG well enough to handle that. 
+	   Remove when proper handling is added. */
+	if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
+		return 0; 
+
 	/* RED-PEN i386 doesn't do _nocache right now */
 	pci_mmcfg_virt = ioremap_nocache(pci_mmcfg_base_addr, MMCONFIG_APER_SIZE);
 	if (!pci_mmcfg_virt) { 

drivers/base/firmware_class.c

@@ -103,7 +103,7 @@ firmware_class_hotplug(struct class_device *class_dev, char **envp,
 			"FIRMWARE=%s", fw_priv->fw_id))
 		return -ENOMEM;
 
-	envp[i++] = NULL;
+	envp[i] = NULL;
 
 	return 0;
 }

drivers/block/cfq-iosched.c

@@ -1688,55 +1688,6 @@ cfq_read_key_type(struct cfq_data *cfqd, char *page)
 	return len;
 }
 
-static ssize_t
-cfq_status_show(struct cfq_data *cfqd, char *page)
-{
-	struct list_head *entry;
-	struct cfq_queue *cfqq;
-	ssize_t len;
-	int i = 0, queues;
-
-	len = sprintf(page, "Busy queues: %u\n", cfqd->busy_queues);
-	len += sprintf(page+len, "key type: %s\n",
-				cfq_key_types[cfqd->key_type]);
-	len += sprintf(page+len, "last sector: %Lu\n",
-				(unsigned long long)cfqd->last_sector);
-	len += sprintf(page+len, "max time in iosched: %lu\n",
-				max_elapsed_dispatch);
-	len += sprintf(page+len, "max completion time: %lu\n", max_elapsed_crq);
-
-	len += sprintf(page+len, "Busy queue list:\n");
-	spin_lock_irq(cfqd->queue->queue_lock);
-	list_for_each(entry, &cfqd->rr_list) {
-		i++;
-		cfqq = list_entry_cfqq(entry);
-		len += sprintf(page+len, "  cfqq: key=%lu alloc=%d/%d, "
-			"queued=%d/%d, last_fifo=%lu, service_used=%lu\n",
-			cfqq->key, cfqq->allocated[0], cfqq->allocated[1],
-			cfqq->queued[0], cfqq->queued[1],
-			cfqq->last_fifo_expire, cfqq->service_used);
-	}
-	len += sprintf(page+len, "  busy queues total: %d\n", i);
-	queues = i;
-
-	len += sprintf(page+len, "Empty queue list:\n");
-	i = 0;
-	list_for_each(entry, &cfqd->empty_list) {
-		i++;
-		cfqq = list_entry_cfqq(entry);
-		len += sprintf(page+len, "  cfqq: key=%lu alloc=%d/%d, "
-			"queued=%d/%d, last_fifo=%lu, service_used=%lu\n",
-			cfqq->key, cfqq->allocated[0], cfqq->allocated[1],
-			cfqq->queued[0], cfqq->queued[1],
-			cfqq->last_fifo_expire, cfqq->service_used);
-	}
-	len += sprintf(page+len, "  empty queues total: %d\n", i);
-	queues += i;
-	len += sprintf(page+len, "Total queues: %d\n", queues);
-	spin_unlock_irq(cfqd->queue->queue_lock);
-	return len;
-}
-
 #define SHOW_FUNCTION(__FUNC, __VAR, __CONV)				\
 static ssize_t __FUNC(struct cfq_data *cfqd, char *page)		\
 {									\
@@ -1824,10 +1775,6 @@ static struct cfq_fs_entry cfq_clear_elapsed_entry = {
 	.attr = {.name = "clear_elapsed", .mode = S_IWUSR },
 	.store = cfq_clear_elapsed,
 };
-static struct cfq_fs_entry cfq_misc_entry = {
-	.attr = {.name = "show_status", .mode = S_IRUGO },
-	.show = cfq_status_show,
-};
 static struct cfq_fs_entry cfq_key_type_entry = {
 	.attr = {.name = "key_type", .mode = S_IRUGO | S_IWUSR },
 	.show = cfq_read_key_type,
@@ -1845,7 +1792,6 @@ static struct attribute *default_attrs[] = {
 	&cfq_back_max_entry.attr,
 	&cfq_back_penalty_entry.attr,
 	&cfq_clear_elapsed_entry.attr,
-	&cfq_misc_entry.attr,
 	NULL,
 };
 

drivers/block/ub.c

@@ -36,7 +36,7 @@
 #define DRV_NAME "ub"
 #define DEVFS_NAME DRV_NAME
 
-#define UB_MAJOR 125	/* Stolen from Experimental range for a week - XXX */
+#define UB_MAJOR 180
 
 /*
  * Definitions which have to be scattered once we understand the layout better.
@@ -1535,8 +1535,11 @@ static int ub_bd_revalidate(struct gendisk *disk)
 
 	ub_revalidate(sc);
 	/* This is pretty much a long term P3 */
+	if (!atomic_read(&sc->poison)) {		/* Cover sc->dev */
 		printk(KERN_INFO "%s: device %u capacity nsec %ld bsize %u\n",
-	    sc->name, sc->dev->devnum, sc->capacity.nsec, sc->capacity.bsize);
+		    sc->name, sc->dev->devnum,
+		    sc->capacity.nsec, sc->capacity.bsize);
+	}
 
 	/* XXX Support sector size switching like in sr.c */
 	blk_queue_hardsect_size(disk->queue, sc->capacity.bsize);

drivers/char/watchdog/i8xx_tco.c

@@ -415,12 +415,15 @@ static unsigned char __init i8xx_tco_getdevice (void)
 			}
 		}
 		/* Set the TCO_EN bit in SMI_EN register */
+		if (!request_region (SMI_EN + 1, 1, "i8xx TCO")) {
+			printk (KERN_ERR PFX "I/O address 0x%04x already in use\n",
+				SMI_EN + 1);
+			return 0;
+		}
 		val1 = inb (SMI_EN + 1);
 		val1 &= 0xdf;
 		outb (val1, SMI_EN + 1);
-		/* Clear out the (probably old) status */
-		outb (0, TCO1_STS);
-		outb (3, TCO2_STS);
+		release_region (SMI_EN + 1, 1);
 		return 1;
 	}
 	return 0;
@@ -443,6 +446,10 @@ static int __init watchdog_init (void)
 		goto out;
 	}
 
+	/* Clear out the (probably old) status */
+	outb (0, TCO1_STS);
+	outb (3, TCO2_STS);
+
 	/* Check that the heartbeat value is within it's range ; if not reset to the default */
 	if (tco_timer_set_heartbeat (heartbeat)) {
 		heartbeat = WATCHDOG_HEARTBEAT;

drivers/i2c/busses/i2c-elektor.c

@@ -59,6 +59,7 @@ static int mmapped;
 
 static wait_queue_head_t pcf_wait;
 static int pcf_pending;
+static spinlock_t lock;
 
 /* ----- local functions ----------------------------------------------	*/
 
@@ -79,10 +80,10 @@ static void pcf_isa_setbyte(void *data, int ctl, int val)
 		break;
 	case 2: /* double mapped I/O needed for UP2000 board,
                    I don't know why this... */
-		writeb(val, address);
+		writeb(val, (void *)address);
 		/* fall */
 	case 1: /* memory mapped I/O */
-		writeb(val, address);
+		writeb(val, (void *)address);
 		break;
 	}
 }
@@ -90,7 +91,7 @@ static void pcf_isa_setbyte(void *data, int ctl, int val)
 static int pcf_isa_getbyte(void *data, int ctl)
 {
 	int address = ctl ? (base + 1) : base;
-	int val = mmapped ? readb(address) : inb(address);
+	int val = mmapped ? readb((void *)address) : inb(address);
 
 	pr_debug("i2c-elektor: Read 0x%X 0x%02X\n", address, val);
 
@@ -111,14 +112,24 @@ static int pcf_isa_getclock(void *data)
 static void pcf_isa_waitforpin(void) {
 
 	int timeout = 2;
+	long flags;
 
 	if (irq > 0) {
-		cli();
+		spin_lock_irqsave(&lock, flags);
 		if (pcf_pending == 0) {
-			interruptible_sleep_on_timeout(&pcf_wait, timeout*HZ );
-		} else
+			spin_unlock_irqrestore(&lock, flags);
+			if (interruptible_sleep_on_timeout(&pcf_wait,
+								timeout*HZ)) {
+				spin_lock_irqsave(&lock, flags);
+				if (pcf_pending == 1) {
+					pcf_pending = 0;
+				}
+				spin_unlock_irqrestore(&lock, flags);
+			}
+		} else {
 			pcf_pending = 0;
-		sti();
+			spin_unlock_irqrestore(&lock, flags);
+		}
 	} else {
 		udelay(100);
 	}
@@ -126,7 +137,9 @@ static void pcf_isa_waitforpin(void) {
 
 
 static irqreturn_t pcf_isa_handler(int this_irq, void *dev_id, struct pt_regs *regs) {
+	spin_lock(&lock);
 	pcf_pending = 1;
+	spin_unlock(&lock);
 	wake_up_interruptible(&pcf_wait);
 	return IRQ_HANDLED;
 }
@@ -134,6 +147,7 @@ static irqreturn_t pcf_isa_handler(int this_irq, void *dev_id, struct pt_regs *r
 
 static int pcf_isa_init(void)
 {
+	spin_lock_init(&lock);
 	if (!mmapped) {
 		if (!request_region(base, 2, "i2c (isa bus adapter)")) {
 			printk(KERN_ERR

drivers/i2c/busses/i2c-ite.c

@@ -62,6 +62,7 @@ static int own;
 static struct iic_ite gpi;
 static wait_queue_head_t iic_wait;
 static int iic_pending;
+static spinlock_t lock;
 
 /* ----- local functions ----------------------------------------------	*/
 
@@ -108,6 +109,7 @@ static int iic_ite_getclock(void *data)
 static void iic_ite_waitforpin(void) {
 
    int timeout = 2;
+   long flags;
 
    /* If interrupts are enabled (which they are), then put the process to
     * sleep.  This process will be awakened by two events -- either the
@@ -116,24 +118,36 @@ static void iic_ite_waitforpin(void) {
     * of time and return.
     */
    if (gpi.iic_irq > 0) {
-	cli();
+	spin_lock_irqsave(&lock, flags);
 	if (iic_pending == 0) {
-		interruptible_sleep_on_timeout(&iic_wait, timeout*HZ );
-	} else
+		spin_unlock_irqrestore(&lock, flags);
+		if (interruptible_sleep_on_timeout(&iic_wait, timeout*HZ)) {
+			spin_lock_irqsave(&lock, flags);
+			if (iic_pending == 1) {
 				iic_pending = 0;
-	sti();
+			}
+			spin_unlock_irqrestore(&lock, flags);
+		}
+	} else {
+		iic_pending = 0;
+		spin_unlock_irqrestore(&lock, flags);
+	}
    } else {
       udelay(100);
    }
 }
 
 
-static void iic_ite_handler(int this_irq, void *dev_id, struct pt_regs *regs) 
+static irqreturn_t iic_ite_handler(int this_irq, void *dev_id,
+							struct pt_regs *regs)
 {
-	
+	spin_lock(&lock);
 	iic_pending = 1;
+	spin_unlock(&lock);
 
 	wake_up_interruptible(&iic_wait);
+
+	return IRQ_HANDLED;
 }
 
 
@@ -221,6 +235,7 @@ static int __init iic_ite_init(void)
 
 	iic_ite_data.data = (void *)piic;
 	init_waitqueue_head(&iic_wait);
+	spin_lock_init(&lock);
 	if (iic_hw_resrc_init() == 0) {
 		if (i2c_iic_add_bus(&iic_ite_ops) < 0)
 			return -ENODEV;

drivers/i2c/busses/i2c-nforce2.c

@@ -26,6 +26,7 @@
 /*
     SUPPORTED DEVICES		PCI ID
     nForce2 MCP			0064
+    nForce2 Ultra 400 MCP	0084
     nForce3 Pro150 MCP		00D4
 
     This driver supports the 2 SMBuses that are included in the MCP2 of the
@@ -291,6 +292,8 @@ static u32 nforce2_func(struct i2c_adapter *adapter)
 static struct pci_device_id nforce2_ids[] = {
 	{ PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE2_SMBUS,
 	       	PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
+	{ PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE2S_SMBUS,
+	       	PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 	{ PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE3_SMBUS,
 	       	PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0 },
 	{ 0 }

drivers/i2c/chips/Kconfig

@@ -32,6 +32,15 @@ config SENSORS_ADM1025
 	  This driver can also be built as a module.  If so, the module
 	  will be called adm1025.
 
+config SENSORS_ADM1026
+	tristate "Analog Devices ADM1026 and compatibles"
+	depends on I2C && EXPERIMENTAL
+	select I2C_SENSOR
+	help
+	  If you say yes here you get support for Analog Devices ADM1026
+	  This driver can also be built as a module.  If so, the module
+	  will be called adm1026.
+
 config SENSORS_ADM1031
 	tristate "Analog Devices ADM1031 and compatibles"
 	depends on I2C && EXPERIMENTAL

drivers/i2c/chips/Makefile

@@ -9,6 +9,7 @@ obj-$(CONFIG_SENSORS_W83781D)	+= w83781d.o
 
 obj-$(CONFIG_SENSORS_ADM1021)	+= adm1021.o
 obj-$(CONFIG_SENSORS_ADM1025)	+= adm1025.o
+obj-$(CONFIG_SENSORS_ADM1026)	+= adm1026.o
 obj-$(CONFIG_SENSORS_ADM1031)	+= adm1031.o
 obj-$(CONFIG_SENSORS_DS1621)	+= ds1621.o
 obj-$(CONFIG_SENSORS_EEPROM)	+= eeprom.o

drivers/i2c/chips/w83l785ts.c

@@ -280,14 +280,17 @@ static u8 w83l785ts_read_value(struct i2c_client *client, u8 reg, u8 defval)
 	 * default value requested by the caller. */
 	for (i = 1; i <= MAX_RETRIES; i++) {
 		value = i2c_smbus_read_byte_data(client, reg);
-		if (value >= 0)
+		if (value >= 0) {
+			dev_dbg(&client->dev, "Read 0x%02x from register "
+				"0x%02x.\n", value, reg);
 			return value;
+		}
 		dev_dbg(&client->dev, "Read failed, will retry in %d.\n", i);
 		msleep(i);
 	}
 
-	dev_err(&client->dev, "Couldn't read value from register. "
-		"Please report.\n");
+	dev_err(&client->dev, "Couldn't read value from register 0x%02x. "
+		"Please report.\n", reg);
 	return defval;
 }
 

drivers/macintosh/therm_adt746x.c

@@ -170,11 +170,11 @@ detach_thermostat(struct i2c_adapter *adapter)
 }
 
 static struct i2c_driver thermostat_driver = {  
-	.name		="Apple Thermostat ADT746x",
-	.id		=0xDEAD7467,
-	.flags		=I2C_DF_NOTIFY,
-	.attach_adapter	=&attach_thermostat,
-	.detach_adapter	=&detach_thermostat,
+	.owner		= THIS_MODULE,
+	.name		= "therm_adt746x",
+	.flags		= I2C_DF_NOTIFY,
+	.attach_adapter	= attach_thermostat,
+	.detach_adapter	= detach_thermostat,
 };
 
 static int read_fan_speed(struct thermostat *th, u8 addr)
@@ -381,7 +381,6 @@ static int attach_one_thermostat(struct i2c_adapter *adapter, int addr,
 	th->clt.addr = addr;
 	th->clt.adapter = adapter;
 	th->clt.driver = &thermostat_driver;
-	th->clt.id = 0xDEAD7467;
 	strcpy(th->clt.name, "thermostat");
 
 	rc = read_reg(th, 0);

drivers/macintosh/therm_pm72.c

@@ -235,8 +235,8 @@ static int therm_pm72_detach(struct i2c_adapter *adapter);
 
 static struct i2c_driver therm_pm72_driver =
 {
+	.owner		= THIS_MODULE,
 	.name		= "therm_pm72",
-	.id		= 0xDEADBEEF,
 	.flags		= I2C_DF_NOTIFY,
 	.attach_adapter	= therm_pm72_attach,
 	.detach_adapter	= therm_pm72_detach,
@@ -266,7 +266,6 @@ static struct i2c_client *attach_i2c_chip(int id, const char *name)
 	clt->addr = (id >> 1) & 0x7f;
 	clt->adapter = adap;
 	clt->driver = &therm_pm72_driver;
-	clt->id = 0xDEADBEEF;
 	strncpy(clt->name, name, I2C_NAME_SIZE-1);
 
 	if (i2c_attach_client(clt)) {

drivers/macintosh/therm_windtunnel.c

@@ -353,12 +353,12 @@ do_detach( struct i2c_client *client )
 }
 
 static struct i2c_driver g4fan_driver = {  
-	.name		= "Apple G4 Thermostat/Fan",
+	.owner		= THIS_MODULE,
+	.name		= "therm_windtunnel",
 	.id		= I2C_DRIVERID_G4FAN,
 	.flags		= I2C_DF_NOTIFY,
-	.attach_adapter = &do_attach,
-	.detach_client	= &do_detach,
-	.command	= NULL,
+	.attach_adapter = do_attach,
+	.detach_client	= do_detach,
 };
 
 static int

drivers/pci/hotplug/cpqphp_pci.c

@@ -194,7 +194,7 @@ static int PCI_ScanBusNonBridge (u8 bus, u8 device)
 
 static int PCI_ScanBusForNonBridge(struct controller *ctrl, u8 bus_num, u8 * dev_num)
 {
-	u8 tdevice;
+	u16 tdevice;
 	u32 work;
 	u8 tbus;
 

drivers/pci/hotplug/pciehp_hpc.c

@@ -1347,6 +1347,9 @@ int pcie_init(struct controller * ctrl,
 	info("HPC vendor_id %x device_id %x ss_vid %x ss_did %x\n", pdev->vendor, pdev->device, 
 		pdev->subsystem_vendor, pdev->subsystem_device);
 
+	if (pci_enable_device(pdev))
+		goto abort_free_ctlr;
+	
 	init_MUTEX(&ctrl->crit_sect);
 	/* setup wait queue */
 	init_waitqueue_head(&ctrl->queue);

drivers/pci/hotplug/shpchp_hpc.c

@@ -1488,6 +1488,9 @@ int shpc_init(struct controller * ctrl,
 	info("HPC vendor_id %x device_id %x ss_vid %x ss_did %x\n", pdev->vendor, pdev->device, pdev->subsystem_vendor, 
 		pdev->subsystem_device);
 	
+	if (pci_enable_device(pdev))
+		goto abort_free_ctlr;
+
 	if (!request_mem_region(pci_resource_start(pdev, 0) + shpc_base_offset, pci_resource_len(pdev, 0), MY_NAME)) {
 		err("%s: cannot reserve MMIO region\n", __FUNCTION__);
 		goto abort_free_ctlr;

drivers/pci/pci-sysfs.c

@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <linux/stat.h>
+#include <linux/topology.h>
 
 #include "pci.h"
 
@@ -42,6 +43,14 @@ pci_config_attr(subsystem_device, "0x%04x\n");
 pci_config_attr(class, "0x%06x\n");
 pci_config_attr(irq, "%u\n");
 
+static ssize_t local_cpus_show(struct device *dev, char *buf)
+{		
+	cpumask_t mask = pcibus_to_cpumask(to_pci_dev(dev)->bus->number);
+	int len = cpumask_scnprintf(buf, PAGE_SIZE-2, mask);
+	strcat(buf,"\n"); 
+	return 1+len;
+}
+
 /* show resources */
 static ssize_t
 resource_show(struct device * dev, char * buf)
@@ -71,6 +80,7 @@ struct device_attribute pci_dev_attrs[] = {
 	__ATTR_RO(subsystem_device),
 	__ATTR_RO(class),
 	__ATTR_RO(irq),
+	__ATTR_RO(local_cpus),
 	__ATTR_NULL,
 };
 

drivers/usb/Makefile

@@ -38,6 +38,7 @@ obj-$(CONFIG_USB_KONICAWC)	+= media/
 obj-$(CONFIG_USB_OV511)		+= media/
 obj-$(CONFIG_USB_PWC)		+= media/
 obj-$(CONFIG_USB_SE401)		+= media/
+obj-$(CONFIG_USB_SN9C102)	+= media/
 obj-$(CONFIG_USB_STV680)	+= media/
 obj-$(CONFIG_USB_VICAM)		+= media/
 obj-$(CONFIG_USB_W9968CF)	+= media/

drivers/usb/core/message.c

@@ -243,14 +243,16 @@ static void sg_complete (struct urb *urb, struct pt_regs *regs)
 		// BUG ();
 	}
 
-	if (urb->status && urb->status != -ECONNRESET) {
+	if (io->status == 0 && urb->status && urb->status != -ECONNRESET) {
 		int		i, found, status;
 
 		io->status = urb->status;
 
 		/* the previous urbs, and this one, completed already.
 		 * unlink pending urbs so they won't rx/tx bad data.
+		 * careful: unlink can sometimes be synchronous...
 		 */
+		spin_unlock (&io->lock);
 		for (i = 0, found = 0; i < io->entries; i++) {
 			if (!io->urbs [i] || !io->urbs [i]->dev)
 				continue;
@@ -263,6 +265,7 @@ static void sg_complete (struct urb *urb, struct pt_regs *regs)
 			} else if (urb == io->urbs [i])
 				found = 1;
 		}
+		spin_lock (&io->lock);
 	}
 	urb->dev = NULL;
 
@@ -524,6 +527,7 @@ void usb_sg_cancel (struct usb_sg_request *io)
 		int	i;
 
 		io->status = -ECONNRESET;
+		spin_unlock (&io->lock);
 		for (i = 0; i < io->entries; i++) {
 			int	retval;
 
@@ -534,6 +538,7 @@ void usb_sg_cancel (struct usb_sg_request *io)
 				dev_warn (&io->dev->dev, "%s, unlink --> %d\n",
 					__FUNCTION__, retval);
 		}
+		spin_lock (&io->lock);
 	}
 	spin_unlock_irqrestore (&io->lock, flags);
 }

drivers/usb/core/urb.c

@@ -451,9 +451,11 @@ int usb_unlink_urb(struct urb *urb)
 		return -EINVAL;
 	if (!(urb->transfer_flags & URB_ASYNC_UNLINK)) {
 #ifdef CONFIG_DEBUG_KERNEL
+		if (printk_ratelimit()) {
 			printk(KERN_NOTICE "usb_unlink_urb() is deprecated for "
 				"synchronous unlinks.  Use usb_kill_urb() instead.\n");
 			WARN_ON(1);
+		}
 #endif
 		usb_kill_urb(urb);
 		return 0;

drivers/usb/core/usb.c

@@ -656,7 +656,7 @@ static int usb_hotplug (struct device *dev, char **envp, int num_envp,
 			return -ENOMEM;
 	}
 
-	envp[i++] = NULL;
+	envp[i] = NULL;
 
 	return 0;
 }

drivers/usb/core/usb.h

@@ -33,3 +33,18 @@ extern struct usb_driver usbfs_driver;
 extern struct file_operations usbfs_devices_fops;
 extern struct file_operations usbfs_device_file_operations;
 extern void usbfs_conn_disc_event(void);
+
+struct dev_state {
+	struct list_head list;      /* state list */
+	struct usb_device *dev;
+	struct file *file;
+	spinlock_t lock;            /* protects the async urb lists */
+	struct list_head async_pending;
+	struct list_head async_completed;
+	wait_queue_head_t wait;     /* wake up if a request completed */
+	unsigned int discsignr;
+	struct task_struct *disctask;
+	void __user *disccontext;
+	unsigned long ifclaimed;
+};
+

drivers/usb/gadget/ether.c

@@ -223,6 +223,10 @@ MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
 #define	DEV_CONFIG_CDC
 #endif
 
+#ifdef CONFIG_USB_GADGET_LH7A40X
+#define DEV_CONFIG_CDC
+#endif
+
 #ifdef CONFIG_USB_GADGET_MQ11XX
 #define	DEV_CONFIG_CDC
 #endif
@@ -235,6 +239,10 @@ MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
 #define	DEV_CONFIG_CDC
 #endif
 
+#ifdef CONFIG_USB_GADGET_PXA27X
+#define DEV_CONFIG_CDC
+#endif
+
 
 /* For CDC-incapable hardware, choose the simple cdc subset.
  * Anything that talks bulk (without notable bugs) can do this.
@@ -247,10 +255,6 @@ MODULE_PARM_DESC(host_addr, "Host Ethernet Address");
 #define	DEV_CONFIG_SUBSET
 #endif
 
-#ifdef CONFIG_USB_GADGET_LH7A40X
-#define DEV_CONFIG_CDC
-#endif
-
 #ifdef CONFIG_USB_GADGET_SA1100
 /* use non-CDC for backwards compatibility */
 #define	DEV_CONFIG_SUBSET
@@ -2321,6 +2325,8 @@ eth_bind (struct usb_gadget *gadget)
 		device_desc.bcdDevice = __constant_cpu_to_le16 (0x0209);
 	} else if (gadget_is_n9604(gadget)) {
 		device_desc.bcdDevice = __constant_cpu_to_le16 (0x0210);
+	} else if (gadget_is_pxa27x(gadget)) {
+		device_desc.bcdDevice = __constant_cpu_to_le16 (0x0211);
 	} else {
 		/* can't assume CDC works.  don't want to default to
 		 * anything less functional on CDC-capable hardware,

drivers/usb/gadget/file_storage.c

@@ -3739,6 +3739,8 @@ static int __init check_parameters(struct fsg_dev *fsg)
 			mod_data.release = 0x0309;
 		else if (gadget_is_n9604(fsg->gadget))
 			mod_data.release = 0x0310;
+		else if (gadget_is_pxa27x(fsg->gadget))
+			mod_data.release = 0x0311;
 		else {
 			WARN(fsg, "controller '%s' not recognized\n",
 				fsg->gadget->name);

drivers/usb/gadget/gadget_chips.h

@@ -68,6 +68,12 @@
 #define	gadget_is_n9604(g)	0
 #endif
 
+#ifdef CONFIG_USB_GADGET_PXA27X
+#define	gadget_is_pxa27x(g)	!strcmp("pxa27x_udc", (g)->name)
+#else
+#define	gadget_is_pxa27x(g)	0
+#endif
+
 // CONFIG_USB_GADGET_AT91RM9200
 // CONFIG_USB_GADGET_SX2
 // CONFIG_USB_GADGET_AU1X00

drivers/usb/gadget/serial.c

@@ -1529,6 +1529,9 @@ static int gs_bind(struct usb_gadget *gadget)
 	} else if (gadget_is_n9604(gadget)) {
 		gs_device_desc.bcdDevice =
 			__constant_cpu_to_le16(GS_VERSION_NUM|0x0009);
+	} else if (gadget_is_pxa27x(gadget)) {
+		gs_device_desc.bcdDevice =
+			__constant_cpu_to_le16(GS_VERSION_NUM|0x0011);
 	} else {
 		printk(KERN_WARNING "gs_bind: controller '%s' not recognized\n",
 			gadget->name);

drivers/usb/gadget/zero.c

@@ -1190,6 +1190,8 @@ zero_bind (struct usb_gadget *gadget)
 		device_desc.bcdDevice = __constant_cpu_to_le16 (0x0209);
 	} else if (gadget_is_n9604(gadget)) {
 		device_desc.bcdDevice = __constant_cpu_to_le16 (0x0210);
+	} else if (gadget_is_pxa27x(gadget)) {
+		device_desc.bcdDevice = __constant_cpu_to_le16 (0x0211);
 	} else {
 		/* gadget zero is so simple (for now, no altsettings) that
 		 * it SHOULD NOT have problems with bulk-capable hardware.

drivers/usb/host/ehci-hcd.c

@@ -379,6 +379,14 @@ static int ehci_hc_reset (struct usb_hcd *hcd)
 	/* cache this readonly data; minimize PCI reads */
 	ehci->hcs_params = readl (&ehci->caps->hcs_params);
 
+	/* at least the Genesys GL880S needs fixup here */
+	temp = HCS_N_CC(ehci->hcs_params) * HCS_N_PCC(ehci->hcs_params);
+	temp &= 0x0f;
+	if (temp && HCS_N_PORTS(ehci->hcs_params) > temp) {
+		temp |= (ehci->hcs_params & ~0xf);
+		ehci->hcs_params = temp;
+	}
+
 	/* force HC to halt state */
 	return ehci_halt (ehci);
 }

drivers/usb/host/ehci-hub.c

@@ -281,8 +281,11 @@ ehci_hub_descriptor (
 	temp = 0x0008;			/* per-port overcurrent reporting */
 	if (HCS_PPC (ehci->hcs_params))
 		temp |= 0x0001;		/* per-port power control */
+#if 0
+// re-enable when we support USB_PORT_FEAT_INDICATOR below.
 	if (HCS_INDICATOR (ehci->hcs_params))
 		temp |= 0x0080;		/* per-port indicators (LEDs) */
+#endif
 	desc->wHubCharacteristics = cpu_to_le16 (temp);
 }
 

drivers/usb/host/ehci-q.c

@@ -175,6 +175,8 @@ static void qtd_copy_status (
 
 static void
 ehci_urb_done (struct ehci_hcd *ehci, struct urb *urb, struct pt_regs *regs)
+__releases(ehci->lock)
+__acquires(ehci->lock)
 {
 	if (likely (urb->hcpriv != 0)) {
 		struct ehci_qh	*qh = (struct ehci_qh *) urb->hcpriv;

drivers/usb/host/ohci-q.c

@@ -35,6 +35,8 @@ static void urb_free_priv (struct ohci_hcd *hc, urb_priv_t *urb_priv)
  */
 static void
 finish_urb (struct ohci_hcd *ohci, struct urb *urb, struct pt_regs *regs)
+__releases(ohci->lock)
+__acquires(ohci->lock)
 {
 	// ASSERT (urb->hcpriv != 0);
 

drivers/usb/host/uhci-hcd.c

@@ -1602,7 +1602,10 @@ static void uhci_free_pending_tds(struct uhci_hcd *uhci)
 	}
 }
 
-static void uhci_finish_urb(struct usb_hcd *hcd, struct urb *urb, struct pt_regs *regs)
+static void
+uhci_finish_urb(struct usb_hcd *hcd, struct urb *urb, struct pt_regs *regs)
+__releases(uhci->schedule_lock)
+__acquires(uhci->schedule_lock)
 {
 	struct uhci_hcd *uhci = hcd_to_uhci(hcd);
 

drivers/usb/input/ati_remote.c

@@ -102,6 +102,7 @@
 #define ATI_REMOTE_VENDOR_ID 	0x0bc7
 #define ATI_REMOTE_PRODUCT_ID 	0x004
 #define LOLA_REMOTE_PRODUCT_ID 	0x002
+#define MEDION_REMOTE_PRODUCT_ID 0x006
 
 #define DRIVER_VERSION 	        "2.2.1"
 #define DRIVER_AUTHOR           "Torrey Hoffman <thoffman@arnor.net>"
@@ -126,6 +127,7 @@ MODULE_PARM_DESC(debug, "Enable extra debug messages and information");
 static struct usb_device_id ati_remote_table[] = {
 	{ USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
 	{ USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA_REMOTE_PRODUCT_ID) },
+	{ USB_DEVICE(ATI_REMOTE_VENDOR_ID, MEDION_REMOTE_PRODUCT_ID) },
 	{}	/* Terminating entry */
 };
 
@@ -730,7 +732,8 @@ static int ati_remote_probe(struct usb_interface *interface, const struct usb_de
 	/* See if the offered device matches what we can accept */
 	if ((udev->descriptor.idVendor != ATI_REMOTE_VENDOR_ID) ||
 		( (udev->descriptor.idProduct != ATI_REMOTE_PRODUCT_ID) &&
-		  (udev->descriptor.idProduct != LOLA_REMOTE_PRODUCT_ID) ))
+		  (udev->descriptor.idProduct != LOLA_REMOTE_PRODUCT_ID) &&
+		  (udev->descriptor.idProduct != MEDION_REMOTE_PRODUCT_ID) ))
 		return -ENODEV;
 
 	/* Allocate and clear an ati_remote struct */

drivers/usb/input/hid-core.c

@@ -94,7 +94,8 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned
 	memset(field, 0, sizeof(struct hid_field) + usages * sizeof(struct hid_usage)
 		+ values * sizeof(unsigned));
 
-	report->field[report->maxfield++] = field;
+	field->index = report->maxfield++;
+	report->field[field->index] = field;
 	field->usage = (struct hid_usage *)(field + 1);
 	field->value = (unsigned *)(field->usage + usages);
 	field->report = report;

drivers/usb/input/touchkitusb.c

@@ -59,6 +59,10 @@
 #define DRIVER_AUTHOR			"Daniel Ritz <daniel.ritz@gmx.ch>"
 #define DRIVER_DESC			"eGalax TouchKit USB HID Touchscreen Driver"
 
+static int swap_xy;
+module_param(swap_xy, bool, 0644);
+MODULE_PARM_DESC(swap_xy, "If set X and Y axes are swapped.");
+
 struct touchkit_usb {
 	unsigned char *data;
 	dma_addr_t data_dma;
@@ -80,6 +84,7 @@ static void touchkit_irq(struct urb *urb, struct pt_regs *regs)
 {
 	struct touchkit_usb *touchkit = urb->context;
 	int retval;
+	int x, y;
 
 	switch (urb->status) {
 	case 0:
@@ -103,13 +108,19 @@ static void touchkit_irq(struct urb *urb, struct pt_regs *regs)
 		goto exit;
 	}
 
+	if (swap_xy) {
+		y = TOUCHKIT_GET_X(touchkit->data);
+		x = TOUCHKIT_GET_Y(touchkit->data);
+	} else {
+		x = TOUCHKIT_GET_X(touchkit->data);
+		y = TOUCHKIT_GET_Y(touchkit->data);
+	}
+
 	input_regs(&touchkit->input, regs);
 	input_report_key(&touchkit->input, BTN_TOUCH,
 	                 TOUCHKIT_GET_TOUCHED(touchkit->data));
-	input_report_abs(&touchkit->input, ABS_X,
-	                 TOUCHKIT_GET_X(touchkit->data));
-	input_report_abs(&touchkit->input, ABS_Y,
-	                 TOUCHKIT_GET_Y(touchkit->data));
+	input_report_abs(&touchkit->input, ABS_X, x);
+	input_report_abs(&touchkit->input, ABS_Y, y);
 	input_sync(&touchkit->input);
 
 exit:

drivers/usb/net/usbnet.c

@@ -527,7 +527,7 @@ static void ax8817x_interrupt_complete(struct urb *urb, struct pt_regs *regs)
 				devdbg(dev, "ax8817x - Link Status is: %d", link);
 			}
 		}
-		usb_submit_urb(data->int_urb, GFP_KERNEL);
+		usb_submit_urb(data->int_urb, GFP_ATOMIC);
 	}
 }
 

drivers/usb/serial/io_edgeport.c

@@ -2797,9 +2797,12 @@ static void change_port_settings (struct edgeport_port *edge_port, struct termio
 static void unicode_to_ascii (char *string, __le16 *unicode, int unicode_size)
 {
 	int i;
-	for (i = 0; i < unicode_size; ++i) {
+
+	if (unicode_size <= 0)
+		return;
+
+	for (i = 0; i < unicode_size; ++i)
 		string[i] = (char)(le16_to_cpu(unicode[i]));
-	}
 	string[unicode_size] = 0x00;
 }
 

drivers/usb/serial/visor.c

@@ -494,10 +494,9 @@ static int visor_write (struct usb_serial_port *port, const unsigned char *buf,
 	spin_lock_irqsave(&priv->lock, flags);
 	if (priv->outstanding_urbs > URB_UPPER_LIMIT) {
 		spin_unlock_irqrestore(&priv->lock, flags);
-		dev_dbg(&port->dev, "write limit hit\n");
+		dbg("%s - write limit hit\n", __FUNCTION__);
 		return 0;
 	}
-	++priv->outstanding_urbs;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
 	buffer = kmalloc (count, GFP_ATOMIC);

drivers/usb/storage/Kconfig

@@ -2,16 +2,23 @@
 # USB Storage driver configuration
 #
 
+comment "NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support' may also be needed; see USB_STORAGE Help for more information"
+
 config USB_STORAGE
 	tristate "USB Mass Storage support"
 	depends on USB
 	select SCSI
 	---help---
 	  Say Y here if you want to connect USB mass storage devices to your
-	  computer's USB port. This is the driver you need for USB floppy drives,
-	  USB hard disks, USB tape drives and USB CD-ROMs, along with
-	  similar devices. This driver may also be used for some cameras and
-	  card readers.
+	  computer's USB port. This is the driver you need for USB
+	  floppy drives, USB hard disks, USB tape drives, USB CD-ROMs,
+	  USB flash devices, and memory sticks, along with
+	  similar devices. This driver may also be used for some cameras
+	  and card readers.
+
+	  This option 'selects' (turns on, enables) 'SCSI', but you
+	  probably also need 'SCSI device support: SCSI disk support'
+	  (BLK_DEV_SD) for most USB storage devices.
 
 	  To compile this driver as a module, choose M here: the
 	  module will be called usb-storage.

drivers/usb/storage/unusual_devs.h

@@ -274,6 +274,14 @@ UNUSUAL_DEV(  0x052b, 0x1801, 0x0100, 0x0100,
 		US_SC_DEVICE, US_PR_DEVICE, NULL,
 		US_FL_IGNORE_RESIDUE ),
 
+/* Another Yakumo camera.
+ * Reported by Michele Alzetta <michele.alzetta@aliceposta.it> */
+UNUSUAL_DEV(  0x052b, 0x1804, 0x0100, 0x0100,
+		"Tekom Technologies, Inc",
+		"300_CAMERA",
+		US_SC_DEVICE, US_PR_DEVICE, NULL,
+		US_FL_IGNORE_RESIDUE ),
+
 /* Reported by Iacopo Spalletti <avvisi@spalletti.it> */
 UNUSUAL_DEV(  0x052b, 0x1807, 0x0100, 0x0100,
 		"Tekom Technologies, Inc",

drivers/w1/Kconfig

@@ -30,7 +30,7 @@ config W1_DS9490
 	  This support is also available as a module.  If so, the module 
 	  will be called ds9490r.ko.
 
-config W1_DS9490R_BRIDGE
+config W1_DS9490_BRIDGE
 	tristate "DS9490R USB <-> W1 transport layer for 1-wire"
 	depends on W1_DS9490
 	help

drivers/w1/dscore.c

@@ -35,26 +35,26 @@ MODULE_DEVICE_TABLE(usb, ds_id_table);
 int ds_probe(struct usb_interface *, const struct usb_device_id *);
 void ds_disconnect(struct usb_interface *);
 
-inline int ds_touch_bit(struct ds_device *, u8, u8 *);
-inline int ds_read_byte(struct ds_device *, u8 *);
-inline int ds_read_bit(struct ds_device *, u8 *);
-inline int ds_write_byte(struct ds_device *, u8);
-inline int ds_write_bit(struct ds_device *, u8);
-inline int ds_start_pulse(struct ds_device *, int);
-inline int ds_set_speed(struct ds_device *, int);
-inline int ds_reset(struct ds_device *, struct ds_status *);
-inline int ds_detect(struct ds_device *, struct ds_status *);
-inline int ds_stop_pulse(struct ds_device *, int);
-inline int ds_send_data(struct ds_device *, unsigned char *, int);
-inline int ds_recv_data(struct ds_device *, unsigned char *, int);
-inline int ds_recv_status(struct ds_device *, struct ds_status *);
-inline struct ds_device * ds_get_device(void);
-inline void ds_put_device(struct ds_device *);
+int ds_touch_bit(struct ds_device *, u8, u8 *);
+int ds_read_byte(struct ds_device *, u8 *);
+int ds_read_bit(struct ds_device *, u8 *);
+int ds_write_byte(struct ds_device *, u8);
+int ds_write_bit(struct ds_device *, u8);
+int ds_start_pulse(struct ds_device *, int);
+int ds_set_speed(struct ds_device *, int);
+int ds_reset(struct ds_device *, struct ds_status *);
+int ds_detect(struct ds_device *, struct ds_status *);
+int ds_stop_pulse(struct ds_device *, int);
+int ds_send_data(struct ds_device *, unsigned char *, int);
+int ds_recv_data(struct ds_device *, unsigned char *, int);
+int ds_recv_status(struct ds_device *, struct ds_status *);
+struct ds_device * ds_get_device(void);
+void ds_put_device(struct ds_device *);
 
 static inline void ds_dump_status(unsigned char *, unsigned char *, int);
-static inline int ds_send_control(struct ds_device *, u16, u16);
-static inline int ds_send_control_mode(struct ds_device *, u16, u16);
-static inline int ds_send_control_cmd(struct ds_device *, u16, u16);
+static int ds_send_control(struct ds_device *, u16, u16);
+static int ds_send_control_mode(struct ds_device *, u16, u16);
+static int ds_send_control_cmd(struct ds_device *, u16, u16);
 
 
 static struct usb_driver ds_driver = {
@@ -503,7 +503,7 @@ int ds_read_byte(struct ds_device *dev, u8 *byte)
 	return 0;
 }
 
-inline int ds_read_block(struct ds_device *dev, u8 *buf, int len)
+int ds_read_block(struct ds_device *dev, u8 *buf, int len)
 {
 	struct ds_status st;
 	int err;
@@ -529,7 +529,7 @@ inline int ds_read_block(struct ds_device *dev, u8 *buf, int len)
 	return err;
 }
 
-inline int ds_write_block(struct ds_device *dev, u8 *buf, int len)
+int ds_write_block(struct ds_device *dev, u8 *buf, int len)
 {
 	int err;
 	struct ds_status st;

drivers/w1/dscore.h

@@ -151,23 +151,23 @@ struct ds_status
 
 };
 
-inline int ds_touch_bit(struct ds_device *, u8, u8 *);
-inline int ds_read_byte(struct ds_device *, u8 *);
-inline int ds_read_bit(struct ds_device *, u8 *);
-inline int ds_write_byte(struct ds_device *, u8);
-inline int ds_write_bit(struct ds_device *, u8);
-inline int ds_start_pulse(struct ds_device *, int);
-inline int ds_set_speed(struct ds_device *, int);
-inline int ds_reset(struct ds_device *, struct ds_status *);
-inline int ds_detect(struct ds_device *, struct ds_status *);
-inline int ds_stop_pulse(struct ds_device *, int);
-inline int ds_send_data(struct ds_device *, unsigned char *, int);
-inline int ds_recv_data(struct ds_device *, unsigned char *, int);
-inline int ds_recv_status(struct ds_device *, struct ds_status *);
-inline struct ds_device * ds_get_device(void);
-inline void ds_put_device(struct ds_device *);
-inline int ds_write_block(struct ds_device *, u8 *, int);
-inline int ds_read_block(struct ds_device *, u8 *, int);
+int ds_touch_bit(struct ds_device *, u8, u8 *);
+int ds_read_byte(struct ds_device *, u8 *);
+int ds_read_bit(struct ds_device *, u8 *);
+int ds_write_byte(struct ds_device *, u8);
+int ds_write_bit(struct ds_device *, u8);
+int ds_start_pulse(struct ds_device *, int);
+int ds_set_speed(struct ds_device *, int);
+int ds_reset(struct ds_device *, struct ds_status *);
+int ds_detect(struct ds_device *, struct ds_status *);
+int ds_stop_pulse(struct ds_device *, int);
+int ds_send_data(struct ds_device *, unsigned char *, int);
+int ds_recv_data(struct ds_device *, unsigned char *, int);
+int ds_recv_status(struct ds_device *, struct ds_status *);
+struct ds_device * ds_get_device(void);
+void ds_put_device(struct ds_device *);
+int ds_write_block(struct ds_device *, u8 *, int);
+int ds_read_block(struct ds_device *, u8 *, int);
 
 #endif /* __DSCORE_H */
 

drivers/w1/w1_int.c

@@ -89,17 +89,14 @@ struct w1_master * w1_alloc_dev(u32 id, int slave_count, int slave_ttl,
 	dev->seq = 1;
 	dev->nls = netlink_kernel_create(NETLINK_NFLOG, NULL);
 	if (!dev->nls) {
-		printk(KERN_ERR "Failed to create new netlink socket(%u).\n",
-			NETLINK_NFLOG);
-		memset(dev, 0, sizeof(struct w1_master));
-		kfree(dev);
-		dev = NULL;
+		printk(KERN_ERR "Failed to create new netlink socket(%u) for w1 master %s.\n",
+			NETLINK_NFLOG, dev->dev.bus_id);
 	}
 
 	err = device_register(&dev->dev);
 	if (err) {
 		printk(KERN_ERR "Failed to register master device. err=%d\n", err);
-		if (dev->nls->sk_socket)
+		if (dev->nls && dev->nls->sk_socket)
 			sock_release(dev->nls->sk_socket);
 		memset(dev, 0, sizeof(struct w1_master));
 		kfree(dev);
@@ -112,7 +109,7 @@ struct w1_master * w1_alloc_dev(u32 id, int slave_count, int slave_ttl,
 void w1_free_dev(struct w1_master *dev)
 {
 	device_unregister(&dev->dev);
-	if (dev->nls->sk_socket)
+	if (dev->nls && dev->nls->sk_socket)
 		sock_release(dev->nls->sk_socket);
 	memset(dev, 0, sizeof(struct w1_master) + sizeof(struct w1_bus_master));
 	kfree(dev);

drivers/w1/w1_netlink.c

@@ -34,6 +34,9 @@ void w1_netlink_send(struct w1_master *dev, struct w1_netlink_msg *msg)
 	struct w1_netlink_msg *data;
 	struct nlmsghdr *nlh;
 
+	if (!dev->nls)
+		return;
+
 	size = NLMSG_SPACE(sizeof(struct w1_netlink_msg));
 
 	skb = alloc_skb(size, GFP_ATOMIC);

include/linux/gen_stats.h

@@ -14,6 +14,7 @@ enum {
 #define TCA_STATS_MAX (__TCA_STATS_MAX - 1)
 
 /**
+ * struct gnet_stats_basic - byte/packet throughput statistics
  * @bytes: number of seen bytes
  * @packets: number of seen packets
  */
@@ -24,6 +25,7 @@ struct gnet_stats_basic
 };
 
 /**
+ * struct gnet_stats_rate_est - rate estimator
  * @bps: current byte rate
  * @pps: current packet rate
  */
@@ -34,10 +36,12 @@ struct gnet_stats_rate_est
 };
 
 /**
+ * struct gnet_stats_queue - queuing statistics
  * @qlen: queue length
  * @backlog: backlog size of queue
  * @drops: number of dropped packets
  * @requeues: number of requeues
+ * @overlimits: number of enqueues over the limit
  */
 struct gnet_stats_queue
 {
@@ -49,6 +53,7 @@ struct gnet_stats_queue
 };
 
 /**
+ * struct gnet_estimator - rate estimator configuration
  * @interval: sampling period
  * @ewma_log: the log of measurement window weight
  */

include/linux/pci_ids.h

@@ -1087,6 +1087,7 @@
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2_IDE	0x0065
 #define PCI_DEVICE_ID_NVIDIA_NVENET_2		0x0066
 #define PCI_DEVICE_ID_NVIDIA_MCP2_AUDIO		0x006a
+#define PCI_DEVICE_ID_NVIDIA_NFORCE2S_SMBUS	0x0084
 #define PCI_DEVICE_ID_NVIDIA_NFORCE2S_IDE	0x0085
 #define PCI_DEVICE_ID_NVIDIA_NVENET_4		0x0086
 #define PCI_DEVICE_ID_NVIDIA_NVENET_5		0x008c

include/linux/usbdevice_fs.h

@@ -144,29 +144,4 @@ struct usbdevfs_hub_portinfo {
 #define USBDEVFS_DISCONNECT        _IO('U', 22)
 #define USBDEVFS_CONNECT           _IO('U', 23)
 
-/* --------------------------------------------------------------------- */
-
-#ifdef __KERNEL__
-
-#include <linux/list.h>
-#include <asm/semaphore.h>
-
-
-struct dev_state {
-	struct list_head list;      /* state list */
-	struct usb_device *dev;
-	struct file *file;
-	spinlock_t lock;            /* protects the async urb lists */
-	struct list_head async_pending;
-	struct list_head async_completed;
-	wait_queue_head_t wait;     /* wake up if a request completed */
-	unsigned int discsignr;
-	struct task_struct *disctask;
-	void __user *disccontext;
-	unsigned long ifclaimed;
-};
-
-#endif /* __KERNEL__ */
-
-/* --------------------------------------------------------------------- */
 #endif /* _LINUX_USBDEVICE_FS_H */

include/net/udp.h

@@ -71,6 +71,8 @@ extern int	udp_sendmsg(struct kiocb *iocb, struct sock *sk,
 extern int	udp_rcv(struct sk_buff *skb);
 extern int	udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
 extern int	udp_disconnect(struct sock *sk, int flags);
+extern unsigned int udp_poll(struct file *file, struct socket *sock,
+			     poll_table *wait);
 
 DECLARE_SNMP_STAT(struct udp_mib, udp_statistics);
 #define UDP_INC_STATS(field)		SNMP_INC_STATS(udp_statistics, field)

net/compat.c

@@ -22,6 +22,7 @@
 #include <linux/filter.h>
 #include <linux/compat.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/security.h>
 
 #include <net/scm.h>
 #include <net/sock.h>
@@ -264,6 +265,9 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
 
 	for (i = 0, cmfptr = (int __user *) CMSG_COMPAT_DATA(cm); i < fdmax; i++, cmfptr++) {
 		int new_fd;
+		err = security_file_receive(fp[i]);
+		if (err)
+			break;
 		err = get_unused_fd();
 		if (err < 0)
 			break;

net/core/gen_estimator.c

@@ -132,6 +132,21 @@ static void est_timer(unsigned long arg)
 	read_unlock(&est_lock);
 }
 
+/**
+ * gen_new_estimator - create a new rate estimator
+ * @bstats: basic statistics
+ * @rate_est: rate estimator statistics
+ * @stats_lock: statistics lock
+ * @opt: rate estimator configuration TLV
+ *
+ * Creates a new rate estimator with &bstats as source and &rate_est
+ * as destination. A new timer with the interval specified in the
+ * configuration TLV is created. Upon each interval, the latest statistics
+ * will be read from &bstats and the estimated rate will be stored in
+ * &rate_est with the statistics lock grabed during this period.
+ * 
+ * Returns 0 on success or a negative error code.
+ */
 int gen_new_estimator(struct gnet_stats_basic *bstats,
 	struct gnet_stats_rate_est *rate_est, spinlock_t *stats_lock, struct rtattr *opt)
 {
@@ -173,6 +188,14 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
 	return 0;
 }
 
+/**
+ * gen_kill_estimator - remove a rate estimator
+ * @bstats: basic statistics
+ * @rate_est: rate estimator statistics
+ *
+ * Removes the rate estimator specified by &bstats and &rate_est
+ * and deletes the timer.
+ */
 void gen_kill_estimator(struct gnet_stats_basic *bstats,
 	struct gnet_stats_rate_est *rate_est)
 {
@@ -200,6 +223,18 @@ void gen_kill_estimator(struct gnet_stats_basic *bstats,
 	}
 }
 
+/**
+ * gen_replace_estimator - replace rate estimator configruation
+ * @bstats: basic statistics
+ * @rate_est: rate estimator statistics
+ * @stats_lock: statistics lock
+ * @opt: rate estimator configuration TLV
+ *
+ * Replaces the configuration of a rate estimator by calling
+ * gen_kill_estimator() and gen_new_estimator().
+ * 
+ * Returns 0 on success or a negative error code.
+ */
 int
 gen_replace_estimator(struct gnet_stats_basic *bstats,
 	struct gnet_stats_rate_est *rate_est, spinlock_t *stats_lock,

net/core/gen_stats.c

@@ -34,6 +34,24 @@ gnet_stats_copy(struct gnet_dump *d, int type, void *buf, int size)
 	return -1;
 }
 
+/**
+ * gnet_stats_start_copy_compat - start dumping procedure in compatibility mode
+ * @skb: socket buffer to put statistics TLVs into
+ * @type: TLV type for top level statistic TLV
+ * @tc_stats_type: TLV type for backward compatibility struct tc_stats TLV
+ * @xstats_type: TLV type for backward compatibility xstats TLV
+ * @lock: statistics lock
+ * @d: dumping handle
+ *
+ * Initializes the dumping handle, grabs the statistic lock and appends
+ * an empty TLV header to the socket buffer for use a container for all
+ * other statistic TLVS.
+ *
+ * The dumping handle is marked to be in backward compatibility mode telling
+ * all gnet_stats_copy_XXX() functions to fill a local copy of struct tc_stats.
+ *
+ * Returns 0 on success or -1 if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
 	int xstats_type, spinlock_t *lock, struct gnet_dump *d)
@@ -52,6 +70,19 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type,
 	return gnet_stats_copy(d, type, NULL, 0);
 }
 
+/**
+ * gnet_stats_start_copy_compat - start dumping procedure in compatibility mode
+ * @skb: socket buffer to put statistics TLVs into
+ * @type: TLV type for top level statistic TLV
+ * @lock: statistics lock
+ * @d: dumping handle
+ *
+ * Initializes the dumping handle, grabs the statistic lock and appends
+ * an empty TLV header to the socket buffer for use a container for all
+ * other statistic TLVS.
+ *
+ * Returns 0 on success or -1 if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
 	struct gnet_dump *d)
@@ -59,7 +90,17 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
 	return gnet_stats_start_copy_compat(skb, type, 0, 0, lock, d);
 }
 
-
+/**
+ * gnet_stats_copy_basic - copy basic statistics into statistic TLV
+ * @d: dumping handle
+ * @b: basic statistics
+ *
+ * Appends the basic statistics to the top level TLV created by
+ * gnet_stats_start_copy().
+ *
+ * Returns 0 on success or -1 with the statistic lock released
+ * if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
 {
@@ -71,6 +112,17 @@ gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b)
 	return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b));
 }
 
+/**
+ * gnet_stats_copy_rate_est - copy rate estimator statistics into statistics TLV
+ * @d: dumping handle
+ * @r: rate estimator statistics
+ *
+ * Appends the rate estimator statistics to the top level TLV created by
+ * gnet_stats_start_copy().
+ *
+ * Returns 0 on success or -1 with the statistic lock released
+ * if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_copy_rate_est(struct gnet_dump *d, struct gnet_stats_rate_est *r)
 {
@@ -82,6 +134,17 @@ gnet_stats_copy_rate_est(struct gnet_dump *d, struct gnet_stats_rate_est *r)
 	return gnet_stats_copy(d, TCA_STATS_RATE_EST, r, sizeof(*r));
 }
 
+/**
+ * gnet_stats_copy_queue - copy queue statistics into statistics TLV
+ * @d: dumping handle
+ * @q: queue statistics
+ *
+ * Appends the queue statistics to the top level TLV created by
+ * gnet_stats_start_copy().
+ *
+ * Returns 0 on success or -1 with the statistic lock released
+ * if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_copy_queue(struct gnet_dump *d, struct gnet_stats_queue *q)
 {
@@ -95,6 +158,19 @@ gnet_stats_copy_queue(struct gnet_dump *d, struct gnet_stats_queue *q)
 	return gnet_stats_copy(d, TCA_STATS_QUEUE, q, sizeof(*q));
 }
 
+/**
+ * gnet_stats_copy_app - copy application specific statistics into statistics TLV
+ * @d: dumping handle
+ * @st: application specific statistics data
+ * @len: length of data
+ *
+ * Appends the application sepecific statistics to the top level TLV created by
+ * gnet_stats_start_copy() and remembers the data for XSTATS if the dumping
+ * handle is in backward compatibility mode.
+ *
+ * Returns 0 on success or -1 with the statistic lock released
+ * if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 {
@@ -103,6 +179,18 @@ gnet_stats_copy_app(struct gnet_dump *d, void *st, int len)
 	return gnet_stats_copy(d, TCA_STATS_APP, st, len);
 }
 
+/**
+ * gnet_stats_finish_copy - finish dumping procedure
+ * @d: dumping handle
+ *
+ * Corrects the length of the top level TLV to include all TLVs added
+ * by gnet_stats_copy_XXX() calls. Adds the backward compatibility TLVs
+ * if gnet_stats_start_copy_compat() was used and releases the statistics
+ * lock.
+ *
+ * Returns 0 on success or -1 with the statistic lock released
+ * if the room in the socket buffer was not sufficient.
+ */
 int
 gnet_stats_finish_copy(struct gnet_dump *d)
 {

net/core/pktgen.c

@@ -647,6 +647,7 @@ static void inject(struct pktgen_info* info)
 	info->do_run_run = 1; /* Cranke yeself! */
 	info->idle_acc = 0;
 	info->sofar = 0;
+	info->errors = 0;
 	lcount = info->count;
 
 

net/ipv4/af_inet.c

@@ -809,7 +809,7 @@ struct proto_ops inet_dgram_ops = {
 	.socketpair =	sock_no_socketpair,
 	.accept =	sock_no_accept,
 	.getname =	inet_getname,
-	.poll =		datagram_poll,
+	.poll =		udp_poll,
 	.ioctl =	inet_ioctl,
 	.listen =	sock_no_listen,
 	.shutdown =	inet_shutdown,

net/ipv4/udp.c

@@ -1303,6 +1303,52 @@ static int udp_getsockopt(struct sock *sk, int level, int optname,
   	return 0;
 }
 
+/**
+ * 	udp_poll - wait for a UDP event.
+ *	@file - file struct
+ *	@sock - socket
+ *	@wait - poll table
+ *
+ *	This is same as datagram poll, except for the special case of 
+ *	blocking sockets. If application is using a blocking fd
+ *	and a packet with checksum error is in the queue;
+ *	then it could get return from select indicating data available
+ *	but then block when reading it. Add special case code
+ *	to work around these arguably broken applications.
+ */
+unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
+{
+	unsigned int mask = datagram_poll(file, sock, wait);
+	struct sock *sk = sock->sk;
+	
+	/* Check for false positives due to checksum errors */
+	if ( (mask & POLLRDNORM) &&
+	     !(file->f_flags & O_NONBLOCK) &&
+	     !(sk->sk_shutdown & RCV_SHUTDOWN)){
+		struct sk_buff_head *rcvq = &sk->sk_receive_queue;
+		struct sk_buff *skb;
+
+		spin_lock_irq(&rcvq->lock);
+		while ((skb = skb_peek(rcvq)) != NULL) {
+			if (udp_checksum_complete(skb)) {
+				UDP_INC_STATS_BH(UDP_MIB_INERRORS);
+				__skb_unlink(skb, rcvq);
+				kfree_skb(skb);
+			} else {
+				skb->ip_summed = CHECKSUM_UNNECESSARY;
+				break;
+			}
+		}
+		spin_unlock_irq(&rcvq->lock);
+
+		/* nothing to see, move along */
+		if (skb == NULL)
+			mask &= ~(POLLIN | POLLRDNORM);
+	}
+
+	return mask;
+	
+}
 
 struct proto udp_prot = {
  	.name =		"UDP",
@@ -1517,6 +1563,7 @@ EXPORT_SYMBOL(udp_ioctl);
 EXPORT_SYMBOL(udp_port_rover);
 EXPORT_SYMBOL(udp_prot);
 EXPORT_SYMBOL(udp_sendmsg);
+EXPORT_SYMBOL(udp_poll);
 
 #ifdef CONFIG_PROC_FS
 EXPORT_SYMBOL(udp_proc_register);

net/ipv6/af_inet6.c

@@ -501,7 +501,7 @@ struct proto_ops inet6_dgram_ops = {
 	.socketpair =	sock_no_socketpair,		/* a do nothing	*/
 	.accept =	sock_no_accept,			/* a do nothing	*/
 	.getname =	inet6_getname, 
-	.poll =		datagram_poll,			/* ok		*/
+	.poll =		udp_poll,			/* ok		*/
 	.ioctl =	inet6_ioctl,			/* must change  */
 	.listen =	sock_no_listen,			/* ok		*/
 	.shutdown =	inet_shutdown,			/* ok		*/